Remediation Agents, Demystified: Why Fixing Beats Finding

Six new security issues for every one issue remediated. That's the ratio Snyk research has found, and it's why the AI Security Engineers Community gave an hour of livestream time to fixing rather than finding.

Play Video: Remediation Agents Demystified: Your AI Teammate for Fixing Security Bugs

Remediation Agents Demystified paired a fireside chat with a live demo. Gérald Crescione, head of the global AI Security Engineers community, hosted, with Ryan McMorrow, who leads remediation products at Snyk, and Brendan Hann, senior product marketing manager for Snyk's developer experience and Agentic AppSec solution.

Remediation Agent, now in public preview, is Snyk’s response to the issue volume problem we’re seeing. As the team continues to build and iterate in public, Snyk is offering Remediation Agent to all current Snyk customers at no additional cost, in exchange for actionable feedback from the community. This feedback can be shared in the community's subreddit.

Why the fix rate stayed flat

The coding agents developers now use everywhere optimize for functional code, not secure functional code, so issue volume is climbing while the fix rate stays flat. AppSec tools answered that with deterministic advice: you're on 1.0, the vulnerability is patched in 1.1, so upgrade. Fine as far as it goes, except somebody still has to prove the upgrade didn't break anything, and no tool was doing that on the developer's behalf. Once the jump spans three or four major versions, most teams never found the confidence to merge at all.

Hann placed that bottleneck inside a broader shift. AI has created three distinct but related pressures: attacks are now automated with AI; agents write software faster than ever and introduce vulnerabilities at the same pace; and AI is reaching production, often ungoverned. Remediation was always a bottleneck, he argued, but it matters more now because attacker tooling changed shape too. Frontier-class models break out of sandboxes and chain previously ignorable low-severity findings into novel zero-days. The backlog of accepted risks has become an attack surface in its own right.

Agentic AppSec covers that combination: preventative controls, frontier-grade detection, and autonomous remediation, and in Hann's words, equipping teams with a team of agents that can actually run their AppSec program for them.

Why throwing an LLM at the backlog doesn't work

Snyk researchers did the obvious first: point an LLM at the security backlog and see what happens.

The model proved extremely enthusiastic and only occasionally right. Developers still had to review every change and reject most of them, which cost about as much time as fixing the issues by hand. A bigger model would have produced more of the same.

The turn came when the team asked a different question: what if the LLM were given everything Snyk knows? Ten years of application security best practices, ecosystem-specific upgrade knowledge, and hard-won experience of which fixes get merged and which don't.

That became the Remediation Agent, described by McMorrow as a harness or orchestration layer sitting between the developer's model of choice and a callable intelligence layer that covers every issue and CVE Snyk tracks. On demand, the agent can pull:

• Breakability assessments for open source upgrades, scoring how likely an upgrade is to break your build, drawn from a database of every package version and every breaking change in it

• Package health and reachability scores, including whether the vulnerable code is exploitable in production

• SAST fix generation through Snyk's Agent Fix capability

• Ecosystem playbooks written by Snyk's own security engineers, covering how a senior practitioner would upgrade a transitive dependency or clear a given class of SAST findings

McMorrow's analogy was that the LLM is being given an open-book test, and Snyk supplies the book. Snyk then grades the agent's homework, re-running scans to confirm the issue is genuinely gone and executing any unit tests in the project to ensure the changes didn't break the build.

The internal results he shared were a 94% improvement in mergeable SCA fixes and a 13% improvement in mergeable SAST fixes, with the majority of internally generated SAST fixes now merging as-is, at meaningfully lower token cost than the naive approach.

Hann added the three patterns Snyk's design partners have had most success with:

1. Backlog burndown campaigns, clearing the low and informational findings that attackers now chain together

2. Org-wide rollouts giving every developer a remediation agent alongside them

3. Using the remediation agent in agentic development environments (ADE) to prevent new issues from entering the codebase

The demo: IDE and CLI

McMorrow ran the agent live against OWASP Juice Shop and showed both entry points.

1. The IDE Path

The IDE path needs two pieces: a /snyk-fix skill and the Snyk Studio MCP server, both installable with one curl command from Snyk's recipes repo. That gets you the full loop inside Cursor, Windsurf, Antigravity, or VS Code with a Claude plugin, from SAST and SCA scans through intelligence lookup, code changes, re-scan, test run, report, and pull request. On stage, it upgraded a vulnerable multer dependency across a major version, confirmed no breaking API change affected the app's disk storage usage, and updated the lock file.

2. The CLI Path

In the CLI, snyk fix --agentic --experimental --sca is more participatory. It lists every package it believes it can upgrade alongside the current version, the target version Snyk recommends because it clears the most criticals and highs, and a breakability score. Developers can:

• Fix everything

• Fix only the low-breakability items

• Select specific findings

• Talk to the agent

McMorrow demonstrated the last option by asking why a Glob major-version jump was rated high risk, and the agent returned the reasoning: a move to a promise-based API, deprecated callback style, path separators becoming escape-only characters, and the Glob class no longer being an event emitter. It also listed the transitive vulnerabilities the upgrade would resolve. The newest version then uses that same breakability intelligence to make the compensating code changes, turning a high-risk upgrade into a low-risk one.

When asked where the rationale comes from, McMorrow explained that the breakability reasoning comes from an analysis of release notes and breaking changes across the open source ecosystem. Design partners have reported few false positives. They're mostly a SAST-side concern, and the agent uses Snyk Code's existing engines to filter them.

Human in the loop, then human on the loop

Every path in the demo ended at a pull request. “We're not going and making crazy code changes,” as Hann put it, and the developer retains final sign-off until an agent has earned enough trust for anyone to yolo-merge their work.

Snyk's own teams run the agent from the CLI today, and an autonomous variant is in active development: Snyk spins up a sandbox, installs the agent, pulls in the application code, and returns a finished PR. Snyk's CI pipeline used to stop on net-new vulnerabilities and hand the problem back to the developer; now it generates the fixes instead, and you merge the agent's work alongside your own commit. Engineers, McMorrow reported, love not having to go back in.

Hann pointed to “backlog zero” as a realistic target, and to blocking malicious packages and slopsquatting at the developer-machine and organization level. McMorrow argued the long game is control, governance, and trust: moving from a human in the loop to a human on the loop. The distinction is who decides, so in the loop is pair programming with an agent, while on the loop is an agent that decides for itself and knows when to call you. Crescione's addition: that's the emerging job description, AI Security Engineers orchestrating a flock of agents on their behalf.

Getting hands-on

Getting started takes a Snyk account and either the CLI or a supported ADE, plus your own model API key, since bring-your-own-LLM is the default for open preview. Open source maintainers can get the whole platform for free through the Secure Developer Program, which includes a full enterprise license.

Found a fix that misses the mark? Tell us in r/AISecEng. Your feedback will help shape where the Remediation Agent goes next as Snyk continues to build and iterate in public.